ET INFO WinHttpRequest (flowbits no alert)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET INFO WinHttpRequest (flowbits no alert)";
    flow:established,to_server;
    flowbits:set,et.WinHttpRequest;
    flowbits:noalert;
    http.host;
    content:!".microsoft.com"; endswith;
    content:!".qq.com"; endswith;
    http.user_agent;
    content:"WinHttp.WinHttpRequest"; fast_pattern;
    classtype:not-suspicious;
    sid:2019821; rev:10;
    metadata:attack_target Client_and_Server, created_at 2014_12_01, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2023_04_20;
)